What's happening
This bill establishes the New York State Online Privacy Act, creating an office to protect online privacy, regulate data breaches, and prohibit employers, schools, and landlords from demanding access to personal internet accounts.
Why it matters
Creates a centralized state office with real authority. The bill establishes an “Office of Online Privacy Protection and Internet Safety,” giving New York a dedicated agency to oversee digital privacy issues, coordinate state agency responses, and develop public education programs—potentially making New York a national leader in online privacy.
Defines and enforces privacy protections for individuals. The legislation lays out clear rules prohibiting employers, schools, and landlords from demanding access to social media or personal internet accounts, aiming to safeguard personal boundaries and prevent abuses or discrimination tied to online activity.
Streamlines and strengthens data breach response. A new “data breach group” is created to coordinate rapid, efficient responses to security breaches, reduce bureaucratic overlap, and provide timely public notifications—helping individuals react more quickly to threats like identity theft.
Mandates strong privacy practices for online service providers. The bill requires providers of personal internet accounts to have clear, federally-aligned privacy policies and to destroy user data upon account cancellation, offering users more control over their information and recourse if providers are negligent.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Protect Online Privacy Rights
Plain English, a few words. Used as the page title.
Sponsors
1 Co-sponsor
History
- Referred to finance
- Referred to finance
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect Online Privacy Rights
In Assembly Committee · Governmental Operations · Sponsor Rebecca Seawright
Full text
10 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
3657
2017-2018 Regular Sessions
IN SENATE
January 25, 2017
Introduced by Sen. GOLDEN -- read twice and ordered printed, and when printed to be committed to the Committee on Finance
AN ACT to amend the executive law and the general business law, in relation to the New York state online privacy act
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Short title. This act may be known and cited as the "New York state online privacy act".
§ 2. The executive law is amended by adding a new article 10-A to read as follows:
ARTICLE 10-A
OFFICE OF ONLINE PRIVACY PROTECTION AND INTERNET SAFETY Section 205. Office of online privacy protection and internet safety;
created.
205-a. Administration.
205-b. Online privacy protection and internet safety advisory
committee.
205-c. Responsibilities.
205-d. Construction.
205-e. Report.
§ 205. Office of online privacy protection and internet safety; created. The office of online privacy protection and internet safety is hereby created in the executive department. Its purposes shall be to promote and protect the online privacy and internet safety of personal information of individuals and private businesses by receiving, addressing, referring, and mediating complaints; developing education and outreach programs, and disseminating model privacy policies; and by coordinating the activities of state agencies performing online privacy protection and internet safety functions.
§ 205-a. Administration. The office shall be headed by a commissioner of online privacy protection and internet safety who shall be appointed
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04247-01-7
S. 3657 2
by the governor by and with the advice and consent of the senate. The commissioner shall possess such rights, powers and duties in connection with privacy protection and internet safety as are expressed or reasonably implied by this article or other applicable laws of this state relating to online privacy and internet safety. The commissioner shall consult with the online privacy protection and internet safety advisory committee in developing policies and programs, and shall coordinate responsibilities concerning security breaches with the data breach group.
§ 205-b. Online privacy protection and internet safety advisory committee. There is hereby created the online privacy protection and internet safety advisory committee, which shall consist of the following ex-officio members or their designees: the secretary of state, the attorney general, the commissioner of the division of homeland security and emergency services, the commissioner of the office of online privacy protection and internet safety, and the director of the office of information technology services. In addition, there shall be appointed by the governor by and with the advice and consent of the senate, five persons who have been employed at the level of executive officer in companies in the information technology industry for a period of five years or more, or employed at a senior management level in the areas of privacy compliance and internet security for a period of five years or more, or as a privacy compliance officer or other high level position requiring expertise in the field of privacy and information technology for such period. The governor shall designate the chair of the advisory committee.
Each appointed member of the committee shall be appointed for terms of three years. Any member may be reappointed for two additional terms. The advisory committee shall meet no less than three times each year, or more if its business requires. The advisory committee shall advise the commissioner on matters relating to online privacy and internet safety concerns. Members of the advisory committee shall receive no compensation but shall be entitled to actual and necessary traveling and other expenses while engaged in the performance of such member's duties hereunder.
The committee shall have the following functions, powers and duties:
1. To review and comment in the manner and form it deems appropriate on proposed rules, regulations, guidelines, and programs of the office;
2. To provide guidance and support to the office in development of policies, programs, and recommendations;
3. To make recommendations concerning surveys and reports; and
4. To perform such other acts as assigned by the chair of the committee which are necessary or appropriate to carry out the functions of the committee and support the operations of the office.
§ 205-c. Responsibilities. The office of online privacy protection and internet safety shall:
1. Receive complaints: Receive complaints concerning violations of articles thirty-nine-H and thirty-nine-F of the general business law, relating to confidentiality and privacy of e-mail and social media and to data security breaches, and violations of other online privacy-related laws, attempt to mediate such complaints where appropriate, and refer complaints to the appropriate governmental agency authorized to take appropriate action on such complaints;
2. Information and referral: Provide information to individuals and entities about obtaining, using, disclosing, or disposing of online personally identifiable information in a lawful manner, and other such online privacy issues as posting of privacy policies, compliance with
S. 3657 3
federal and state laws and guidelines concerning personal information of minors, and others;
3. Education and outreach: Develop and coordinate public and private informational and educational programs and materials to foster and improve public understanding concerning online privacy and internet safety, including programs targeted to minors in consultation with the education department;
4. Model policies: develop and disseminate model online privacy policies;
5. Training: Assist as requested in the training of local, state, and federal law enforcement agencies and others regarding the prevention of identity theft and other online privacy-related crimes;
6. Coordinate security breach procedures: Coordinate effective responses to online security breaches with the data breach group;
7. Research: Conduct investigations, research, studies and analyses of matters affecting the online privacy and internet safety; and
8. Advise: Advise and make recommendations to the governor concerning online privacy and internet safety.
§ 205-d. Construction. The authority of the office of online privacy protection and internet safety to adopt regulations under this article shall be limited exclusively to those regulations necessary to implement subdivisions one through six of section two hundred five-c of this article. Nothing contained herein shall be deemed to apply to the legislature or the judiciary, or except as specifically otherwise provided in law, to a state agency as such term is defined by section one hundred one of the state technology law.
§ 205-e. Report. The office shall report annually not later than the thirtieth of January each year to the governor, the temporary president of the senate, the speaker of the assembly, the minority leaders of the senate and assembly, and the public beginning in the first calendar year after the effective date of this section concerning: the number of complaints received and the resolutions thereof by category or class of complaint, the numbers of closed cases, and any recommendations concerning improvements in online privacy laws and procedures and internet safety.
§ 3. Section 399-ddd of the general business law, as added by chapter 372 of the laws of 2012, is renumbered section 399-dddd.
§ 4. Subdivision 1 of section 399-dddd, as added by chapter 372 of the laws of 2012 and such section as renumbered by section three of this act, is amended to read as follows:
1. As used in this section, "social security account number" shall include the number issued by the federal social security administration and any number derived from such number, or any part of such number. Such term shall not include any number that has been encrypted.
§ 5. Paragraph (a) of subdivision 1 of section 399-ddd of the general business law, as amended by chapter 371 of the laws of 2012, is amended to read as follows:
(a) As used in this section "social security account number" shall include the number issued by the federal social security administration and any number derived from such number, or any part of such number. Such term shall not include any number that has been encrypted.
§ 6. The general business law is amended by adding a new article 39-H to read as follows:
ARTICLE 39-H
THE NEW YORK STATE ONLINE ACCOUNTS AND SOCIAL MEDIA PRIVACY ACT Section 900. Short title.
S. 3657 4
901. Definitions.
902. Purpose.
903. Requests for disclosure by employers.
904. Requests for disclosure by an educational institution.
905. Prohibited and permitted activities by landlord.
906. Construction.
907. Remedies.
§ 900. Short title. This article shall be known and may be cited as the "online media privacy act".
§ 901. Definitions. As used in this article: 1. "Adverse action" means to discharge, threaten, or otherwise discriminate against an employee in any manner that affects the employee's employment, including compensation, terms, conditions, location, rights, immunities, promotions, or privileges.
2. "Educational institution" means a college, university, academy, school district and city school district or other entity offering secondary education, program offering career education or higher education, as such terms are defined in section two of the education law, and any other institution of higher education, technical college, school, public school, charter school, private school, and any private educational testing service or administrator.
3. "Employer" means a person, including the state or a political subdivision of the state, that has one or more workers employed in the same business or business activity, or in or about the same establishment, with the right to control and direct the work provided by such workers.
4. "Personal internet account" means an online account that is used by an employee or an applicant for employment exclusively for personal communications unrelated to any business purpose of the employer, but does not include an account created, maintained, used, or accessed by an employee or applicant for employment for business related communications or for a business purpose of the employer. As used herein, "personal internet account" also means and includes social media accounts and website or online services, as defined in this section, used by an employee or an applicant for employment exclusively for personal communications unrelated to any business purpose of the employer but not created, maintained, used, or accessed by an employee or applicant for employment for business related communications or for a business purpose of the employer.
5. "Social media" means an internet-based service that allows individuals to engage in activities which include but are not limited to the following: construct a public or semi-public profile within a bounded system, created by the service; create a list of other users with whom they share a connection within the system; and view and navigate their list of connections and those made by others within the system. Social media includes Facebook, e-mail, and Twitter accounts, and other similar services, and websites and online services which include the activities described in this subdivision, and the digital media contained in those sites, including photos, videos, texts and e-mail messages.
6. "Website or online service" means and includes a website, online service, online application, mobile application, electronic service or account, that contains electronic content, including but not limited to videos, still photographs, blogs, video blogs, podcasts, instant and text messages, e-mail, online services or accounts, or website profiles or locations.
S. 3657 5
§ 902. Purpose. The purpose of this article is to protect the privacy of online users against inappropriate intrusion.
§ 903. Requests for disclosure by employers. 1. Except as otherwise provided herein, an employer may not seek disclosure of information related to a personal internet account in any of the following ways. An employer may not:
(a) request or require an employee or an applicant for employment to disclose a username and password, or a password, that allows access to the employee's or applicant's personal internet account;
(b) request or require an employee or applicant for employment to add the employer or an employment agency to the employee's or applicant's list of contacts associated with a personal internet account;
(c) request or require an employee or an applicant for employment to access a personal internet account in the presence of the employer in a manner that enables the employer to observe the contents of the employee's or applicant's personal internet account; or
(d) take adverse action, including fail to hire, or otherwise penalize an employee or applicant for employment for failure to disclose information or failure to take actions specified in this subdivision.
2. The foregoing provisions of this section to the contrary notwithstanding, nothing contained herein shall prohibit an employer from doing any of the following:
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the executive law and the general business law, in relation to the New York state online privacy act
Purpose
To create a comprehensive framework to protect the online privacy and promote internet safety of private and personal information of individuals and businesses
Summary of provisions
Section 1. Bill title.
Read the full memo (1,554 words)
Section 2. New Office of Online Privacy and Internet Safety. Creates a new article 10-A in the executive law, the Office of privacy protection and internet safety, to promote and protect the online privacy and internet safety of personal information of individuals and private businesses by receiving, addressing, referring, and mediating complaints, developing education and outreach programs, and disseminating model privacy policies; by conducting research; and by coordinating the activities of state agencies performing online privacy protection and Internet safety functions. The Office is headed by a commissioner appointed by the governor by and with the advice and consent of the Senate. Reports are die by Jan 30 of each year on the activities of the office.
Creates the online privacy protection and internet safety advisory committee, of 10 public and private appointees. the Secretary of State, Attorney General, Commissioner of Homeland Security, Commissioner of the Office of Online Privacy Protection and Internet Safety, and the Director of the Office of Information Technology Services; and five persons who have been employed at the level of executive officer in companies in the information technology industry for a period of five years or more. All private individuals are appointed for three years by the Governor with the advise and consent of the Senate. The purpose of the committee is to advise the commissioner on matters relating to online privacy and internet safety concerns, review and comment on rules, regulations, guidelines, and programs of the office, provide guidance and support for program development; make recommendations; and take other actions. The existence of the committee assures that there will be ongoing communication and coordination between all entities involved in online privacy protection and online security and safety.
Language elsewhere in the bill including in the effective date requires the executive to submit a plan for the orderly transfer of appropriate functions and personnel to the new office from the Office of Information Technology Services, Consumer Affairs, Homeland Security, and other agencies as may be appropriate, within six months of the passage of the act, and to transfer funds for the agency subsequent to that time, but in no case later than by the beginning of the next fiscal year.
Section 3, 4, and 5.Privacy protections extended for Social Security Numbers.
Renumbers and amends sections § 399-ddd of the General Business law to extend the same requirements for privacy of social security numbers to any part of the SS number.
Sections 6. Privacy of NYS Online Accounts and Social Media Privacy Act renumbers section 900 and 901 of the general business law and creates a new Article 39-H, the NYS Online Accounts and Social Media Privacy Act, to prohibit employers, educational institutions, and landlords from requiring employees or prospective employees, students or prospective students, and tenants or prospect tenants respectively to provide access to personal email or social media accounts or from requiring access to these accounts, or to take adverse action against them for refusing access.
The section also creates exceptions to this prohibition, for accounts paid for by the employer or the academic institution; information in the public domain, disciplining or discharging an employee for transferring the employer's proprietary or confidential information or financial data to an employee's personal internet account without authorization; conducting an investigation if there is specific information about activity on the employee's personal internet account, or in the case of unlawful activities or misconduct Waiver of the section concerning employees or prospective employees is declared contrary to public policy and void and unenforceable Students are allowed to voluntarily consent to disclosure. Remedies include an action brought by the Attorney General, and a civil penalty of $500 per violation.
Sections 7 and 8. Privacy protections extended against phishing Amends 390-b of the General Business law (phishing) to include social media and to prohibit individuals from deceptively representing themselves as another person in order to obtain financial information or information which would allow such person to gain access to financial information. The law currently applies only to a person deceptively representing himself or herself as an agent of a business or government.
Sections 9, 10, and 11. Privacy protections extended in breach law Amends Article 39-F of the General Business law (breach law) to add a Data Breach group to consist of the attorney general, the secretary of state, the commissioner of the division of homeland security and emergency services, the chief information officer of the office of information technology services, the superintendent of the division of state police, and the commissioner of the office of online privacy and inter-net safety They are to work together to streamline notification and handling of data breaches. Current law requires that breach notification go separately to the Attorney general, the Secretary of State, and the Division of State Police.
Section 12. Requirement for privacy policy & notification of disposal of private information.
Amends the General Business Law to create a new Article 39-I, Requirements For Use And Destruction Of Online Personal And Private Information. Requires that online services provide notice as to their privacy policy and the process for destruction of personal information. Sets liability as actual damages incurred and court costs, but allows a 30-day window for a provider to come into compliance after notification.
Section 13. Grants authority to the director of the budget, the comptroller of the state of New York and the commissioner of civil service to implement the intent and specific instructions of the rest of the bill.
Section 14. Severability.
Section 15. Provides that this bill will take effect the January after it receives the signature of the Governor.
Existing law
New bill. Current law requires notification of breaches to Consumer Affairs (Department of State), the Attorney General, and the State Police. Current law has requirements for confidentiality for social security numbers but not for portions of the numbers Current phishing statutes only apply to falsely representing oneself as an agent of a business or government.
Justification
While there are laws on the books in New York intended to provide privacy protections, these have not been undated in some years, and changes in technology and in available resource have made some of the intended protections less robust than when originally enacted. At the same time, some State agencies have gained additional expertise and ability to deal with and work with privacy issues This measure seeks to draw on the best knowledge, information, and expertise, and reform the system where necessary in ways that will increase privacy protections for individuals, businesses large and small, and for other entities.
A key way in which this is done is by the creation of an Office of Privacy Protection and Internet Safety, reporting directly to the Governor, and working with a public-private advisory group to stay current as to new threats and opportunities. The new office will assure that consumers receive timely information concerning security breaches, and will work with the Attorney General and others to develop and coordinate appropriate state responses when there are breaches, develop model privacy and Internet safety policies for businesses and internet entities, provide education and training to individuals and businesses in collaboration with the online industry, and create an ongoing policy group to anticipate new technologies and programs and threats.
The development of new internet tools and programs - and threats - is moving very rapidly As an example, ten years ago there was no Twitter, Facebook was just being launched, and Pinterest had not been dreamed of Each new technological development brings enjoyment and entertainment, but also is a ground for new threats We need to be looking and these and balancing the issues of pleasure, risk, and security People and businesses need to know what steps they can take to protect themselves, and what to do if their security is violated.
The recent news reports about large-scale breaches of security and loss of personally identifiable information to hackers has worrisome consequences. Significantly, since only the breaches get reported, there are thousands of ongoing daily attacks on public and private websites and internet services that the public never hears of. The risk threat is ongoing.
There are several purposes to the legislation to inform and educate consumers concerning online privacy and in Internet safety issues, to insure that providers are taking all necessary steps to protect the confidentiality of the information they receive; to coordinate an adequate State response to help individual consumers and businesses, and to prosecute hackers and offenders; to prohibit certain violations of privacy by corporations, academic, and landlords; and to rewrite the privacy laws in this area to insure that penalties are equal to the damages inflicted.
This is needed legislation at a time of dramatically enhanced and new threats to personal and civic security.
History
2015: S.4073 - Referred to Energy and Communications 2016: S.4073 - Referred to Energy and Communications
Fiscal implications
To be determined.
Effective date
The first day of the year succeeding its enactment.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.